CVE-2026-43311: Linux Kernel Privilege Escalation Flaw

CVE-2026-43311 Overview

CVE-2026-43311 is a Linux kernel vulnerability in the soc/tegra/pmc driver affecting NVIDIA Tegra platforms. The flaw stems from an unsafe call to generic_handle_irq() from a non-interrupt context during system suspend resume. When resuming from suspend, the tegra186_pmc_wake_syscore_resume path invokes generic_handle_irq() outside of hard IRQ context, triggering a kernel warning at kernel/irq/irqdesc.c:666. Local authenticated users on affected Tegra-based systems can trigger this condition, leading to availability impact through kernel instability.

Critical Impact
A local low-privileged user on a Tegra platform can trigger kernel warnings and potential availability degradation through system suspend/resume cycles, with no confidentiality or integrity impact.

Affected Products

Linux Kernel (mainline, prior to patched commits)
NVIDIA Tegra186 SoC platforms running affected kernel versions
Downstream distributions shipping the vulnerable soc/tegra/pmc driver

Discovery Timeline

2026-05-08 - CVE-2026-43311 published to NVD
2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-43311

Vulnerability Analysis

The vulnerability resides in the Tegra Power Management Controller (PMC) driver, specifically in the suspend/resume path. During the syscore_resume phase, tegra186_pmc_wake_syscore_resume() calls generic_handle_irq() directly. This function must run in hard IRQ context, but the syscore resume callback executes in process context with interrupts in a state that violates the IRQ subsystem's safety assumptions.

The kernel's IRQ descriptor subsystem detects this constraint violation and emits a WARNING at kernel/irq/irqdesc.c:666 inside handle_irq_desc(). While the warning itself is non-fatal, it indicates an unsafe code path that can cause unpredictable interrupt handling behavior on Tegra platforms after every resume cycle [CWE-NVD-CWE-noinfo].

The fix defers the generic_handle_irq() call to an IRQ work item using the IRQ_WORK_INIT_HARD() variant. This ensures the deferred work executes in hard IRQ context on both standard and PREEMPT_RT kernels, where regular IRQ work would otherwise run in preemptible per-CPU kthreads.

Root Cause

The root cause is a context mismatch between the syscore resume callback and the requirements of generic_handle_irq(). The PMC driver assumed it could dispatch wake interrupt handlers directly during resume, but the IRQ core requires hard IRQ context for interrupt descriptor handling to maintain locking and preemption invariants.

Attack Vector

Exploitation requires local access with low privileges. A user able to trigger system suspend (pm_suspend) on an affected Tegra platform causes the unsafe IRQ dispatch path to execute on every resume. Repeated suspend/resume cycles can produce kernel log noise, interrupt mis-delivery, and availability impact on the host. No remote attack vector exists, and there is no confidentiality or integrity impact.

No public proof-of-concept exploit is available, and the EPSS data reflects a very low probability of exploitation activity.

Detection Methods for CVE-2026-43311

Indicators of Compromise

Kernel ring buffer entries containing WARNING: CPU: 0 PID: ... at kernel/irq/irqdesc.c:666
Stack traces referencing handle_irq_desc, tegra186_pmc_wake_syscore_resume, and syscore_resume
Repeated warnings correlated with pm_suspend and suspend_devices_and_enter events on Tegra hardware

Detection Strategies

Monitor dmesg and journalctl -k for IRQ descriptor warnings tied to the Tegra PMC resume path.
Audit kernel versions across Tegra-based device fleets to identify hosts running pre-patch kernels.
Correlate suspend/resume telemetry with kernel warning frequency to identify affected systems.

Monitoring Recommendations

Forward kernel logs from edge and embedded Tegra deployments to a centralized log platform for warning pattern detection.
Track installed kernel package versions against the upstream stable trees referenced in the kernel.org commits.
Alert on unexpected kernel WARN_ON events originating from kernel/irq/irqdesc.c across the fleet.

How to Mitigate CVE-2026-43311

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the kernel.org stable commits 64016227dcdb and e6d96073af68.
Update Tegra-based systems to a kernel release that includes the fixed soc/tegra/pmc driver.
Inventory NVIDIA Tegra hardware in production and prioritize patching for systems performing frequent suspend/resume cycles.

Patch Information

The upstream fix replaces the direct generic_handle_irq() invocation with an IRQ work item initialized via IRQ_WORK_INIT_HARD(). Refer to the Kernel Git Commit 64016227dcdb and Kernel Git Commit e6d96073af68 for the authoritative patches. Distribution maintainers should backport these commits to supported stable branches.

Workarounds

Restrict the ability of unprivileged users to trigger system suspend on affected Tegra hosts via polkit or systemd-logind policy controls.
Disable suspend-to-RAM functionality on impacted Tegra platforms where business requirements permit, until patches are deployed.
Limit physical and administrative access to Tegra-based appliances to reduce the local attack surface.

bash

# Verify the running kernel version on a Tegra system
uname -r

# Check dmesg for the unsafe IRQ warning signature
dmesg | grep -E "irqdesc|tegra186_pmc_wake_syscore_resume"

# Restrict unprivileged suspend via polkit (example rule)
# /etc/polkit-1/rules.d/10-restrict-suspend.rules
polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.login1.suspend" &&
        !subject.isInGroup("wheel")) {
        return polkit.Result.AUTH_ADMIN;
    }
});